If you're using Homebrew /usr/local/bin should already be at the front of $PATH or at least come before /usr/bin. If you now run brew link --force openssl in your terminal window, open a new one and run which openssl in it. It should now show openssl under /usr/local/bin.

For what it's worth, I just used homebrew (http://brew.sh/):

brew update  
brew install openssl  
brew link --force openssl 
openssl version -a  

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this:

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is):

mv /usr/bin/openssl /usr/bin/openssl_OLD  
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.

Using brew:

brew update
brew install openssl@1.1
echo 'export PATH="$(brew --prefix)/opt/openssl@1.1/bin:$PATH"' >> ~/.bash_profile
# Verify 
openssl version
# OpenSSL 1.1.1c  28 May 2019

I think this is a multi-part issue with the versions of Python you are using and your $PATH variable.

First check where you're looking for Python by using this command in the terminal:

which python

It should output something like this: /usr/local/bin/python

Then check for the path that you have setup.

echo $PATH

Likely you're seeing something like:

/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/username/anaconda/bin:/usr/bin:/bin:/usr/sbin:/sbin

The issue is probably that the version of python tied to your default when you enter python in your terminal is not one that has the modern version of openssl.

In other words:

openssl version -a

Is checking for openssl somewhere different than

python -c "import ssl; print ssl.OPENSSL_VERSION"

To fix this, you might try editing your $PATH variable.

I suggest doing this by editing something like your ~/.bash_profile file. You can add something like this to specify a different Python binary to use:

export PATH="/usr/local/bin:$PATH"

Plop this on the end of your .bash_profile file and then whenever you're using bash it should look for Python in the /usr/local/bin directory before looking elsewhere. Keep in mind that this might also affect places that other programs look for Python (or other binaries).

Execute following commands:

brew update
brew install openssl
echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.bash_profile
source ~/.bash_profile

You will have the latest version of openssl installed and accessible from cli (command line/terminal). Since the third command will add export path to .bash_profile, the newly installed version of openssl will be accessible across system restarts.

IMO the best way to install openssl on MacOS is to use Homebrew. This will not only install openssl, but will also allow it to be upgraded in the future.

brew install openssl

If you want to make the Homebrew version the default (rather than the LibreSSL that comes with MacOS), you will also need put the Hombrew-installed openssl on your path ahead of the MacOS version. While it is possible to accomplish this by putting /opt/homebrew/bin on your PATH ahead of /usr/bin, I strongly discourage this, because it makes you vulnerable to unintentionally installing a malicious Homebrew package named something like ls that overrides your default ls with malicious code. Instead, my personal preference is to have a user-level directory where I maintain a small set of binaries that override the defaults.

# Create a user-level bin directory, if it doesn't already exist.
mkdir -p ~/bin

# Create a symlink to the Homebrew openssl, if such a symlink does not already exist
ln -fs /opt/homebrew/bin/openssl ~/bin/openssl

Then, put ~/bin on your PATH, ahead of /usr/bin. This part depends on which shell you are using. For bash, you can add this to your ~/.bash_profile.

# User-level binaries, manually added
PATH="${HOME}/bin:${PATH}"